Himanshu Anand :: Security & Other Notes

TLDR I used a public Linux kernel bug to make one CPU keep using a memory mapping after another CPU had removed it.

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration.

TLDR I am not working full time right now, which means I have free time which is dangerous.

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration.

The Anti-India Influence Machine: Troll Farms, Fake News, Newsrooms, Algorithms and AI Scope and disclaimer: This is a cybersecurity research article focused on India because I am from India, India is the information environment I notice most and the chan…

TLDR I independently found a heap out-of-bounds read/write in KVM’s SEV-SNP Page State Change handler.

Two Parsers, One JSON, and a Flag Intigriti’s July challenge is called “Canonically Yours” and the whole bug is one silly question: what happens when you put the same key in a JSON object twice?

TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations.

If your team trains models or fine tunes LLMs on Vertex AI, one training permission is all it takes to take over the whole project.

TLDR; June 2026 was the biggest Patch Tuesday Microsoft has ever shipped 208 CVEs.

TLDR; Three posts ago I wrote baout house was on fire the most import question arises was what we should do next?

TLDR; I read five security patches and I derived working exploits from all five.

TLDR; Score severity by collision count.

TLDR The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow.

I was poking around the OpenSSL source code recently.

TLDR While looking for a way to stream the India vs Pakistan cricket match on 14th September 2025, I stumbled across a suspicious search result on a europa.eu dev subdomain.

TLDR I have recieved a legit Zoom doc email from HR “while on job hunt” .

A step by step guide how to hack webhooks kinda this is a crossover post between threat hunters and bug hunters. at the end of the day it is all about hunting. this post will talk about hunting and threat hunting using webhooks for those who don’t know wh…

Starting Point It all began with a tweet: sdcyberresearch on X This tweet hinted at a Magecart-style campaign involving malicious JavaScript injection to skim payment data.

In light of recent npm/Node.js supply-chain news, I am resurfacing a small game I built: Typosquat Detective.

I wanted to quickly highlight something I have noticed in multiple cases but this time let me explain with a real example.

If you or your company have been building with large language models (LLMs) you have probably come across the term prompt injection.

Disclaimer: This is NOT a zero-day.

We are excited to announce the launch of our new API for Cloud Intel Atomic Indicators, a tool designed to provide essential data on malicious IP addresses.

Greetings Cybersecurity Enthusiasts!

Hello everyone!

Hello, readers!

Hello everyone!

Hello, and welcome to my page!